CB Response: Why are childproc counts different across API calls

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Why do different API calls for the same process return different childproc counts?

Environment

• CB Response: All versions

Resolution

• The API versions differ in what is pulled
• Counts will differ based on the segment included

Additional Information

• /api/v1/process/XXX is used to plot TreeView on the process analysis page 
• /api/v5/process/XXX/event is used to show data in the bottom of a Process Analysis (event lists)